Splunk Search

global replace of field values?

Splunk Employee
Splunk Employee

I have the value "N/A" that is applied to any field that doesn't have an entry. I need to change this to a numerical value in order to do my charting. How would I accomplish this? 'fillnull' would almost do it if it would accept the value (N/A) I'm looking for.

Thanks, Mike

Tags (3)

Re: global replace of field values?


EDIT: Better idea.

Use the Replace function to replace the string "N/A" with whatever numerical value you desire in whatever fields you want. Far more efficient than my original suggestion.

View solution in original post